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The BRIC4 bluetooth protocol can be found among the BRIC4 
docs on https://www.caveexpLoration.org/gear/bric4 


For these test I used a Note 3 with Resurrection Remix AOSP 
Android 7. To prepare Android for BT snoop: 

- enable developer options 

- under developer options enable HCI-snoop 

- turn BT off and on 


See the image on the right. 





[1] BLE 2.6 TEST WITH SUBSCRIPTION 


For this test the BRIC4 has BLE protocol v. 2.6. 
TopoDroid has been compiled with BRIC4 support, but without subscription to the 
BRIC4 protocol characteristics, PRIM, META, and ERROR. 


First TopoDroid is started on Android. 
The (blue) download button is pressed; 
it turns orange, and, when the BRIC4 is 
turned on, it becomes red. Two shots are 
taken with the BRIC4. They are shown on 
the BRIC4 display, but not on TopoDroid, 
of course, because the app did not 
subscribed to the notification. 


Here iS TopoDroid log. There are only 
the entry points of the functions and 
callbacks traversed during connection 
and disconnection. 





04-01 09:15:11.950 17745 17803 V Distox : BRIC comm ***** disconnect device 
04-01 09:15:11.950 17745 17803 V DistoxX : BRIC comm ***** connect device 
04-01 09:15:11.959 17745 17803 V DistoxX : BRIC comm ***** connect BRIC device 
04-01 09:15:11.960 17745 17803 V DistoxX : BRIC comm ***** connect GATT 

04-01 09:15:18.668 17745 17758 V DistoxX : BRIC comm service discovered 

04-01 09:15:33.174 17745 17745 V Distox : BRIC comm ***** disconnect device 
04-01 09:15:33.174 17745 17745 V Distox : BRIC comm ***** close device 

04-01 09:15:33.175 17745 17745 V Distox : BRIC comm ***** disconnect GATT 


To pull the btsnoop_hci.log file I get on Android (adb shell), go su, and copy it 
in the external memory: 

hlte:/ $ su 

hlte:/ # cp /data/misc/bLuetooth/logs/btsnoop_hci.log /mnt/sdcard/ 


A couple of Ctrl-D and I'm back on the PC. I pull the file, and open it with 
wireshark. I apply a filter to see only the comminication with the BRIC4: 
bluetooth.addr == d5:2f:de:2e:98:de 

adb pull /sdcard/btsnoop_hci. log 


/sdcard/btsnoop_hci. log: 1 file pulled, © skipped. 7.9 MB/s (98574 bytes in 0.012s) 
wireshark 






























[|] btsnoop_hci-20210401a.log [es pt pled 
File Edit View Go Capture Analyze Statistics Telephony Wireless Tools Help 
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No. Time Source Destination Protocol Lengtt Info 
892 41.028029 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... L2CAP 21 Revd Connection Parameter Update Request 
893 41.031869 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () L2CAP 15 Sent Connection Parameter Update Response (Accepted) 
898 41.599835 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: 0x0024 (Unknown) 
899 41.600854 SamsungE_67: (Sa.. d5:2f:de:2e: ATT Sent Handle Value Confirmation, Handle: 0x0024 (Unknown) 


d5:2f:de:2e: 








SamsungE 67: 32 Rcvd Handle Value Indication, Handle: 0x0028 (Unknown 






— 902 41.797043 SamsungE_67: (Sa.. d5:2f:de:2e: ( 10 Sent Handle Value Confirmation, Handle: 90x0028 (Unknown) 
904 41.990002 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (S lon LE 32 Revd Handle Value Indication, Handle: 0x002c (Unknown) 
905 41.990977 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x002c (Unknown) 
907 47.373721 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: 0x0024 (Unknown) 
908 47.375867 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 0x0024 (Unknown) 
909 47.551906 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: 0x0028 (Unknown) 
910 47.552943 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x0028 (Unknown) 
912 47.840070 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: 0x002c (Unknown) 
913 47.840784 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: Ox002c (Unknown) 

4 > 
>» Frame 901: 32 bytes on wire (256 bits), 32 bytes captured (256 bits) “ 
>» Bluetooth 
>» Bluetooth HCI H4 
> Bluetooth HCI ACL Packet 
>» Bluetooth L2CAP Protocol v 


02 40 20 ib 00 17 OO 04 O00 id 28 O00 be 00 00 00 ri ( 
ac a/v 6b c2 2c 22 a2 41 00 00 ac 41 3e 00 00 2c k:,""A A>:-, 








@ 7 btsnoop hci-20210401a.log Packets: 918 « Displayed: 14 (1.5%) Profile: Default 


Notice that the BRIC4 sends immediately the data to Android. 

The PRIM, META, ERROR characteristics have handles 0x0024, 0x0028 and Ox002c, 
respective Ly. 

The image highlights the content on the META for the first data. The payload begins 
at byte 12. It starts with be 00 00 00 ... which is (as int32) 190. The same index 
number of the first shot taken with the BRIC4. 


[2] BLE 2.6 TEST WITH SUBSCRIPTION 
For this test the BRIC4 has BLE protocol v. 2.6. 


TopoDroid has been compiled with BRIC4 support, and subscription to the 
BRIC4 protocol characteristics, PRIM, META, and ERROR, is enabled. 


First TopoDroid is started on Android. The (blue) download button is pressed; it 
turns orange, and, when the BRIC4 is turned on, it becomes red. Two shots are taken 
with the BRIC4. They are shown on the BRIC4 display, and on TopoDroid. Everything 
seems to work. 
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Next the BRIC4 is taken away, 


so that the BT connection is lost, and two more 


shots are taken. When the BRIC4 and Android regain the BT connection the data are 
transferred, but only the second one appears in TopoDroid [images below]. 


The TopoDroid log is longer, as it includes the Log of the transferred data. A 
written descriptor corresponds to the callback of a subscription. Ther is the UUID 
of the characteristics. A characteristics changed corresponds to the notification 


that some data has arrived. 


Following that are logs about the payload. It can be 


seen that after restoring the connection the first charcaterteristic change 
META (000058d2). 


notified to 


04-01 09:56:17. 
04-01 09:56:17. 
04-01 09:56:17. 
04-01 09:56:17. 
04-01 09:56:27. 
04-01 09:56:27 
04-01 09:56:27. 
04-01 09:56:27. 
04-01 09:56:32 
04-01 09:56:32 
04-01 09:56:32 
1.3325 Azimuth 
04-01 09:56:32. 


the 


950 
950 
962 
962 
175 


.485 


983 
681 


491 
497 
499 


app 


19480 
19480 
19480 
19480 
19480 
19480 
19480 
19480 
19480 
19480 
19480 


3.5200686 


505 


19480 


isa 


19563 
19563 
19563 
19563 
19492 
19493 
19541 
19492 
19493 
19497 
19497 
Clino 
19497 


Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
V Distox 
-0.7740152 
V Distox 


V 
V 
V 
V 
V 
V 
V 
V 
V 
V 


3.520068645477295 -0.7740151882171631 

19480 19541 V Distox 
19480 19497 V Distox 
19480 19497 V Distox 


04-01 09:56:32. 
04-01 09:56:32. 
04-01 09:56:32. 


685 
688 
689 


0.76475847 temp 24. 


04-01 09:56:32. 
04-01 09:56:32. 
04-01 09:56:32. 
04-01 09:56:32. 
04-01 09:56:32. 
04-01 09:56:36. 
04-01 09:56:36. 
04-01 09:56:36. 
1.6885 Azimuth 
04-01 09:56:36. 


690 
880 
881 
881 
882 
780 
785 
187 
302. 
788 


© samples 63 type 0 


19480 
19480 
19480 
19480 
19480 
19480 
19480 
19480 
86996 
19480 


19497 
19492 
19497 
19497 
19497 
19493 
19497 
19497 
Clino 
19497 


V Distox 
V Distox 
V Distox 
V Distox 
V Distox 
V Distox 
V Distox 
V Distox 
-4,324498 
V Distox 


302.8699645996094 -4.324498176574707 

974 19480 19541 V Distox 
975 19480 19497 V Distox 
977 19480 19497 V Distox 
24.0 samples 63 


04-01 09:56:36. 
04-01 09:56:36. 
04-01 09:56:36. 
358.54773 temp 
04-01 09:56:36. 
04-01 09:56:37. 
04-01 09:56:37. 
04-01 09:56:37. 
04-01 09:56:37. 
04-01 09:57:11. 


978 
174 
175 
175 
176 
650 


failure - status 8 


04-01 09:57:11. 
04-01 09:57:11. 
04-01 09:57:32. 


673 
708 
158 


19480 
19480 
19480 
19480 
19480 
19480 


19480 
19480 
19480 


failure - status 133 


04-01 09:57:32. 
04-01 09:57:32. 
04-01 09:57:41. 
04-01 09:57:42. 
04-01 09:57:42. 
04-01 09:57:42. 


159 
159 
939 
009 
009 
009 


355.7435 temp 24.0 


04-01 09:57:42. 
04-01 09:57:42. 
04-01 09:57:42 
04-01 09:57:42 
04-01 09:57:42 
04-01 09:57:42 
prev 193 

04-01 09:57:42 


009 
058 


401 
402 
403 
404 


.450 


19480 
19480 
19480 
19480 
19480 
19480 


19497 
19492 
19497 
19497 
19497 
19493 


19493 
19493 
19492 


19492 
19492 
19492 
19493 
19497 
19497 


type 0 

V Distox 
V Distox 
V Distox 
V Distox 
V Distox 
V Distox 


V Distox 
V Distox 
V Distox 


V Distox 
V Distox 
V Distox 
V Distox 
V Distox 
V Distox 


samples 58 type 0 


19480 
19480 
19480 
19480 
19480 
19480 


19480 


19497 
19541 
19492 
19497 
19497 
19497 


19493 


V Distox 
V Distox 
V Distox 
V Distox 
V Distox 
V Distox 


V Distox 


BRIC comm ***** disconnect device 

BRIC comm ***** connect device 

BRIC comm ***** connect BRIC device 

BRIC comm ***** connect GATT 

BRIC comm service discovered 

BRIC comm desc written 000058d2-0000-1000-8000 -00805f9b34Ffb 
BRIC comm desc written 000058d3-0000-1000-8000 -00805f9b34Ffb 
BRIC comm desc written 000058d1-0000-1000-8000 -00805f9b34Ffb 
BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer PRIM 

392499 BRIC debug MeasPrim: 20 2021-4-1 8:53:0 Distance 


392504 BRIC proto: added Prim 1.3324999809265137 


BRIC comm changed chrt 000058d2-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer META 
392689 BRIC debug MeasMeta: 20 Idx 192 dip -60.348206 roLL 


392690 BRIC proto: added Meta 192 

BRIC comm changed chrt 000058d3-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer ERR 

392881 BRIC proto: added Err 

392882 BRIC proto: process - PrimToDo true: 192 prev -1 
BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer PRIM 

396787 BRIC debug MeasPrim: 20 2021-4-1 8:53:5 Distance 


396788 BRIC proto: added Prim 1.6885000467300415 


BRIC comm changed chrt 000058d2-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer META 
396977 BRIC debug MeasMeta: 20 Idx 193 dip -57.681137 roll 


396978 BRIC proto: added Meta 193 

BRIC comm changed chrt 000058d3-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer ERR 

397175 BRIC proto: added Err 

397176 BRIC proto: process - PrimToDo true: 193 prev 192 
431650 BLE callback: callback onConnectionStateChange 


BRIC comm ***** reconnect device 
BRIC comm ***** connect GATT 
452158 BLE callback: callback onConnectionStateChange 


BRIC comm ***** reconnect device 

BRIC comm ***** connect GATT 

BRIC comm service discovered 

BRIC comm changed chrt 000058d2-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer META 

462009 BRIC debug MeasMeta: 20 Idx 194 dip -46.64026 roll 


462009 BRIC proto: added Meta 194 

BRIC comm desc written 000058d2-0000-1000-8000-00805f9b34fb 
BRIC comm changed chrt 000058d3-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer ERR 

462403 BRIC proto: added Err 

462403 BRIC proto: process - PrimToDo false: ... Skip at 194 


BRIC comm desc written 000058d3-0000-1000-8000-00805f9b34fb 


04-01 09:57:42,548 19480 19541 V DistoX : BRIC comm desc written 000058d1-0000-1000-8000-00805f9b34fb 
04-01 09:57:42.550 19480 19541 V DistoX : BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
04-01 09:57:42.550 19480 19497 V DistoxX : BRIC comm: Queue buffer PRIM 

04-01 09:57:42,552 19480 19497 V Distox : 462551 BRIC debug MeasPrim: 20 2021-4-1 8:53:53 Distance 
1.5495 Azimuth 286.97318 Clino -4.497937 

04-01 09:57:42.553 19480 19497 V DistoX : 462553 BRIC proto: added Prim 1.5494999885559082 

286 .9731750488281 -4.497937202453613 

04-01 09:57:42.645 19480 19493 V DistoX : BRIC comm changed chrt 000058d2-0000-1000-8000-00805f9b34fb 
04-01 09:57:42.646 19480 19497 V DistoX : BRIC comm: Queue buffer META 

04-01 09:57:42,648 19480 19497 V DistoxX : 462647 BRIC debug MeasMeta: 20 Idx 195 dip -47.006977 roll 
358.85263 temp 24.0 samples 58 type 0 

04-01 09:57:42,648 19480 19497 V DistoX : 462648 BRIC proto: added Meta 195 

04-01 09:57:42.793 19480 19492 V DistoX : BRIC comm changed chrt 000058d3-0000-1000-8000-00805f9b34fb 
04-01 09:57:42.794 19480 19497 V DistoX : BRIC comm: Queue buffer ERR 

04-01 09:57:42.794 19480 19497 V Distox : 462794 BRIC proto: added Err 

04-01 09:57:42.795 19480 19497 V DistoxX : 462795 BRIC proto: process - PrimToDo true: 195 prev 194 


In order to see what happened I get the btsnoop_hci.log file from Android, and 
inspect it with wireshark. The crucial point is that as soon as the connection is 
regained the BRIC4 transfers the PRIM payload, which is ackloledged by Android. 
This happens before Android takes the first subscription to the protocol 
charcateristics from the app. The screenshot shows the PRIM payload. The shot data 
Start at byte 20: 84 cO 82 3f ... which is the little endian representation of 
1.02150011 

[| scadacore.com/tools/programming-calculators/onlLine-hex-converter | 





[|] btsnoop_hci-20210401b.log [53 hed plead 
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| |bluetooth.addr == d5:2f:de:2e:98:de x, ~| Expression... + 
No. Time Source Destination Protocol Lengtt Info = 
917 51.272642 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: 0x0028 (Unknown) 
918 51.278001 SamsungE_67:62:d7 (Sa.. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 90x0028 (Unknown) 
920 51.471859 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: Qx002c (Unknown) 
921 51.472901 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x002c (Unknown) 





208034 d5:2f:de:2e:98: SamsungE_ 67:62: ie Handle Value Indication, Handle: 0x0024 (Unknown 


— 939 116.209099 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 90x0024 (Unknown) 
943 116.256063 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 14 Sent Write Request, Handle: 0x0029 (Unknown) 
948 116.309665 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: 0x0028 (Unknown) 
950 116.310203 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x0028 (Unknown) 
953 116.358325 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 10 Rcvd Write Response, Handle: 0x0029 (Unknown) 
954 116.362532 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 14 Sent Write Request, Handle: 0x002d (Unknown) 
957 116.699956 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: 0x002c (Unknown) ~~ 
958 116.700777 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x002c (Unknown) 
959 116.748465 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 10 Revd Write Response, Handle: Ox002d (Unknown) 
960 116.759574 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 14 Sent Write Request, Handle: 0x0025 (Unknown) 
962 116.845305 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 10 Revd Write Response, Handle: 0x0025 (Unknown) 
963 116.847010 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: 0x0024 (Unknown) 
964 116.847959 SamsungE_67:62:d7 (Sa.. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 90x0024 (Unknown) 
965 116.943607 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: 0x0028 (Unknown) 
966 116.944657 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 90x0028 (Unknown) 
968 117.089821 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: 0x002c (Unknown) 
969 117.091241 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: Ox002c (Unknown) 
971 120.990351 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. L2CAP 21 Revd Connection Parameter Update Request 
972 120.993937 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () L2CAP 15 Sent Connection Parameter Update Response (Accepted) 
4 . 
~ Bluetooth Attribute Protocol 7 


» Opcode: Handle Value Indication (0x1d) 
Handle: 9x0024 (Unknown) 
Value: e50704010835302984c0823feaaa8e433cle0icd 





[Response in Frame: 939] be 
0000 02 40 20 ib 00 17 00 04 O00 id 24 00 EaraCE ms 
clowicmmoSs 35 30 29 84 cO 82 3f ea aa Be 43 3c ie O1 cO 


@ 7 Value (btatt.value), 20 bytes Packets: 1028 : Displayed: 40 (3.9%) Profile: Default 











[3] BLE 2.7 TEST WITH SUBSCRIPTION 


The BRIC4 BLE firmware 2.7 introduced a delay of a few seconds between the 
connection and the beginnig of the data transfer. By this means when the BRIC4 and 
Android regain the BT connection the data are not immediately transferred, and 
there is time for the Android to accept the app subscriptions. 
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Here 1S TopoDroid log. Notice that there are more than four seconds between the 
service discovered and the characteristic changed callbaks. 


04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 


11:38: 


14. 
./5/ 19480 
./68 19480 
./69 19480 
./75 19480 
.969 19480 
.066 19480 
.165 19480 
./6/7 19480 
./68 19480 
./70 19480 


1.5215 Azimuth 


04-01 11:38:31. 
357 .28912353515625 
04-01 11:38:31.955 
04-01 11:38:31.960 
04-01 11:38:31.961 


75/7 19480 


357 .28912 
772 19480 


22656 
22656 
22656 
22656 
19493 
19492 
19541 
19493 
19492 
19497 
19497 
Clino 
19497 


354.8741 temp 25.75 samples 64 


04-01 
04-01 
04-01 
04-01 
04-01 
04-01 


11:38: 
11:38: 
11:38: 
11:38: 
11:38: 
11:39: 


OL; 
.152 19480 
.159 19480 
.160 19480 
.160 19480 
.240 19480 


962 19480 


failure - status 8 


04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 


04-01 11:40:00. 
04-01 11:40:00. 
04-01 11:40:00. 


11:39: 
11:39: 
ce ee 
11:39: 
11:39: 
11:39: 
11240; 
11:40: 
11:40: 
Azimuth 291. 
04-01 11:40: 


32. 
32. 
.566 19480 
.949 19480 
.143 19480 
.241 19480 
.190 19480 
.191 19480 
.191 19480 
3667 Clino -2.4712453 


276 19480 
2/7/ 19480 


19497 
19493 
19497 
19497 
19497 
19492 


19492 
19492 
19541 
19492 
19493 
19541 
19492 
19497 
19497 


V 
V 
V 
V 
V 
V 
V 
V 
V 
V 
V 
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Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 


.028375 


Distox 


4.028375148773193 

19480 19541 V Distox 
19480 19497 V Distox 
19480 19497 V Distox 


type 0 


V 


V 
V 
V 
V 
V 


<<<<<<< < 


V 


Distox 
Distox 
Distox 
Distox 
Distox 
Distox 


Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 
Distox 


00.193 19480 19497 V Distox 
-2.471245288848877 
367 19480 19493 V Distox 
368 19480 19497 V Distox 
368 19480 19497 V Distox 


347.34995 temp 


04-01 11:40:00. 
04-01 11:40:00. 
04-01 11:40:00. 


25.75 samples 63 type 0 

369 19480 19497 V Distox 
564 19480 19541 V Distox 
565 19480 19497 V Distox 


BRIC comm ***** disconnect device 

BRIC comm ***** connect device 

BRIC comm ***** connect BRIC device 

BRIC comm ***** connect GATT 

BRIC comm service discovered 

BRIC comm desc written 000058d2-0000-1000 -8000-00805f9b34Ffb 
BRIC comm desc written 000058d3-0000-1000 -8000-00805f9b34Ffb 
BRIC comm desc written 000058d1-0000-1000-8000-00805f9b34Ffb 
BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer PRIM 

511770 BRIC debug MeasPrim: 20 2021-4-1 10:35:0 Distance 


511771 BRIC proto: added Prim 1.5214999914169312 


BRIC comm changed chrt 000058d2-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer META 
511961 BRIC debug MeasMeta: 20 Idx 198 dip -59.979134 roll 


511962 BRIC proto: added Meta 198 

BRIC comm changed chrt 000058d3-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer ERR 

512159 BRIC proto: added Err 

512160 BRIC proto: process - PrimToDo true: 198 prev -1 
572240 BLE callback: callback onConnectionStateChange 


BRIC comm ***** reconnect device 

BRIC comm ***** connect GATT 

BRIC comm service discovered 

BRIC comm desc written 000058d2-0000-1000 -8000-00805f9b34Ffb 
BRIC comm desc written 000058d3-0000-1000-8000-00805f9b34Ffb 
BRIC comm desc written 000058d1-0000-1000-8000-00805f9b34Ffb 
BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer PRIM 

191 BRIC debug MeasPrim: 20 2021-4-1 10:36:6 Distance 1.2535 


193 BRIC proto: added Prim 1.253499984741211 291.36669921875 


BRIC comm changed chrt 000058d2-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer META 
368 BRIC debug MeasMeta: 20 Idx 199 dip -48.425594 roll 


368 BRIC proto: added Meta 199 
BRIC comm changed chrt 000058d3-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer ERR 





04-01 11:40:00.565 19480 19497 V DistoX : 565 BRIC proto: added Err 

04-01 11:40:00.566 19480 19497 V DistoX : 566 BRIC proto: process - PrimToDo true: 199 prev 198 

04-01 11:40:00.757 19480 19492 V DistoX : BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
04-01 11:40:00.758 19480 19497 V DistoX : BRIC comm: Queue buffer PRIM 

04-01 11:40:00.758 19480 19497 V Distox 758 BRIC debug MeasPrim: 20 2021-4-1 10:36:11 Distance 
1.2835001 Azimuth 325.33768 Clino -81. 210495 

04-01 11:40:00.761 19480 19497 V DistoX : 761 BRIC proto: added Prim 1.283500075340271 
325.3376770019531 -81.21049499511719 

04-01 11:40:00.954 19480 19493 V DistoX : BRIC comm changed chrt 000058d2-0000-1000-8000-00805f9b34fb 
04-01 11:40:00.955 19480 19497 V DistoX : BRIC comm: Queue buffer META 

04-01 11:40:00.960 19480 19497 V DistoX : 960 BRIC debug MeasMeta: 20 Idx 200 dip -47.09689 roLl 
268.42627 temp 25.75 samples 78 type 0 

04-01 11:40:00.960 19480 19497 V DistoxX : 960 BRIC proto: added Meta 200 

04-01 11:40:01.149 19480 19541 V DistoX : BRIC comm changed chrt 000058d3-0000-1000-8000-00805f9b34fb 
04-01 11:40:01.150 19480 19497 V DistoX : BRIC comm: Queue buffer ERR 

04-01 11:40:01.150 19480 19497 V DistoX : 1150 BRIC proto: added Err 

04-01 11:40:01.151 19480 19497 V DistoX : 1151 BRIC proto: process - PrimToDo true: 200 prev 199 


With wireshark I find a similar delay between the connection and the data transfer, 
and this gives the app enough time to subscribe to the notifications. As the 
screenshot below shows, the app subscriptions are completed within about one 
second, and the first data transfer takes place almost 5 seconds after the 
connection is established. 





[|] btsnoop_hci-20210401c.log [ht plead 
File Edit View Go Capture Analyze Statistics Telephony Wireless Tools Help 


AQACORF RO LC eae? LE QAAaQae 





| |bluetooth.addr == d5:2f:de:2e:98:de x ~| Expression... + 
No. Time Source Destination Protocol Lengtt Info = 
930 78.113383 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 0x0024 (Unknown) 
931 78.303032 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: 0x0028 (Unknown) 
932 78.309398 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 90x0028 (Unknown) 
934 78.497857 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: Ox002c (Unknown) 
935 78.500606 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x002c (Unknown) 
951 161.926995 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 14 Sent Write Request, Handle: 0x0029 (Unknown) 
955 162.297296 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 10 Revd Write Response, Handle: 0x0029 (Unknown) 
956 162.309254 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 14 Sent Write Request, Handle: 0x002d (Unknown) 
958 162.492235 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 10 Revd Write Response, Handle: Ox002d (Unknown) 
959 162.502842 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 14 Sent Write Request, Handle: 0x0025 (Unknown) 
960 162.589746 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 10 Revd Write Response, Handle: 0x0025 (Unknown) 
962 166.295947 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. L2CAP 21 Revd Connection Parameter Update Request 
963 166.298833 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () L2CAP 15 Sent Connection Parameter Update Response (Accepted) 
d5:2f:de:2e:98: SamsungE 67: S Value Indication, Handle: 0x0024 (Unknown 
— 968 166.545946 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 90x0024 (Unknown) 
969 166.716512 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: 0x0028 (Unknown) —— 
971 166.720399 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 90x0028 (Unknown) 
973 166.911628 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: 0x002c (Unknown) 
974 166.912744 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x002c (Unknown) 
976 167.106415 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: 0x0024 (Unknown) 
977 167.111632 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 0x0024 (Unknown) 
979 167.301749 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: 0x0028 (Unknown) 
980 167.309114 SamsungE_67:62:d7 (Sa.. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 0x0028 (Unknown) 
982 167.496751 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: Ox002c (Unknown) 
, 983 167.497859 SamsungE 67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation. Handle: 9x002c CUnknown be 
» Frame 967: 32 bytes on wire (256 bits), 32 bytes captured (256 bits) - 
>» Bluetooth 
>» Bluetooth HCI H4 
>» Bluetooth HCI ACL Packet 
>» Bluetooth L2CAP Protocol be 


02 40 20 ib 00 17 00 04 O00 id 24 00 e5 O7 04 O1 @ $ 
Oa 24 06 Sf bO 72 a0 3F FO ae 91 43 e2 28 ie cO S:_-r? ‘C-( 





@ 7 btsnoop hci-20210401c.log Packets: 987 - Displayed: 34 (3.4%) Profile: Default 





Apparently the BRIC4 BLE protocol seems to work now. 
Does it really works ? 


[4] A BRIC4 BLE PROTOCOL MODEL 
From these results it seems that the BRIC4 communicates with Android only, and it 


relies on Android forwarding the data to the app. On the oter hand Android accept a 
connection from the BRIC4 only when there is an app ready to take the data. 


The following picture summarizes this model. 

The data flow between the BRIC4 and Android goes on bluetooth. The data exchange 
between Android and the app is done with the Android BLE API functions and 
callbacks. 





In order to further test the protocol I ran a number of tests in which the BRIC4 is 
brought at a distance from the Android so that the bluetooth connection is broken. 
At that point the BRIC4 may be switched off, or let it turn off by timeout. Then 
Switched on and a couple of shots are taken. In the meanwhile, the user on the 
Android app can just wait for the connection to come back, or close it, and re- 
connect, either before the BRIC4 is back or after that. 


These tests were all successful in that all the data were transferred to the app. 


Here is the TopoDroid Log of one of them. It is quite Long, therefore groups of log 
statements are replaced by ellipses. I comment the sequence of actions in between 
the log statements. 


04-01 20:04:19.038 19480 30607 V DistoxX : BRIC comm ***** disconnect device 

04-01 20:04:19.038 19480 30607 V DistoxX : BRIC comm ***** connect device 

04-01 20:04:19.061 19480 30607 V DistoxX : BRIC comm ***** connect BRIC device 

04-01 20:04:19.061 19480 30607 V DistoxX : BRIC comm ***** connect GATT 

04-01 20:04:23.819 19480 19493 V DistoxX : BRIC comm service discovered 

the BRIC4 connects and a shot is taken - index 207 

04-01 20:04:24.004 19480 19541 V DistoxX : BRIC comm desc written 000058d2-0000-1000-8000-00805f9b34Ffb 
04-01 20:04:24.103 19480 19492 DistoX : BRIC comm desc written 000058d3 -0000-1000-8000-00805f9b34fb 
04-01 20:04:24,201 19480 19493 DistoX : BRIC comm desc written 000058d1-0000-1000-8000-00805f9b34fb 
04-01 20:04:31.338 19480 19541 DistoX : BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
04-01 20:04:31.341 19480 19497 DistoX : BRIC comm: Queue buffer PRIM 

04-01 20:04:31.342 19480 19497 V Distox : 271342 BRIC debug MeasPrim: 20 2021-4-1 19:0:59 Distance 
1.4565 Azimuth 282.0348 Clino 21.555956 

04-01 20:04:31.344 19480 19497 V DistoX : 271344 BRIC proto: added Prim 1.4565000534057617 

282 .0347900390625 21.55595588684082 

04-01 20:04:31.527 19480 19492 V DistoX : BRIC comm changed chrt 000058d2-0000-1000-8000-00805f9b34fb 
04-01 20:04:31.530 19480 19497 V DistoxX : BRIC comm: Queue buffer META 

04-01 20:04:31.531 19480 19497 V DistoxX : 271531 BRIC debug MeasMeta: 20 Idx 207 dip -57.783913 roll 
354.03033 temp 22.5 samples 63 type 0 

04-01 20:04:31.532 19480 19497 V DistoX : 271532 BRIC proto: added Meta 207 


V 
V 
V 
V 


the BRIC4 is brougt away and the connection is Lost 

04-01 20:04:44,242 19480 19541 V Distox : 284242 BLE callback: callback onConnectionStateChange 
failure - status 8 

04-01 20:04:44.314 19480 19541 V DistoX : BRIC comm ***** reconnect device 


04-01 20:06:14.524 19480 19493 V Distox 
04-01 20:06:43.715 19480 19492 V Distox 
the BRIC4 is back and shots are transfer 
04-01 20:06:43.970 19480 19493 V Distox 


04-01 20:06:49.341 19480 19541 V Distox 
04-01 20:06:49.342 19480 19497 V Distox 
04-01 20:06:49.343 19480 19497 V Distox 
5.958858 temp 22.5 samples 57 type 0 

04-01 20:06:49.344 19480 19497 V Distox 
04-01 20:06:49.538 19480 19492 V Distox 
04-01 20:06:49.539 19480 19497 V Distox 
04-01 20:06:49.540 19480 19497 V Distox 
04-01 20:06:49.541 19480 19497 V Distox 
04-01 20:06:49.728 19480 19493 V Distox 


04-01 20:06:50.125 19480 19497 V Distox 
04-01 20:06:50.125 19480 19497 V Distox 
04-01 20:07:03.781 19480 19480 V Distox 
04-01 20:07:03.781 19480 19480 V Distox 
04-01 20:07:03.781 19480 19480 V Distox 


In the following test 


re 


BRIC comm ***** connect GATT 
BRIC comm service discovered 


BRIC comm desc written 000058d2-0000-1000-8000-00805f9b34Ffb 


BRIC comm changed chrt 000058d2-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer META 
409343 BRIC debug MeasMeta: 20 Idx 208 dip -60.4403 roll 


409344 BRIC proto: added Meta 208 

BRIC comm changed chrt 000058d3-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer ERR 

409539 BRIC proto: added Err 

409540 BRIC proto: process - PrimToDo true: 208 prev 207 
BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 


410125 BRIC proto: added Err 

410125 BRIC proto: process - PrimToDo true: 209 prev 208 
BRIC comm ***** disconnect device 

BRIC comm ***** close device 

BRIC comm ***** disconnect GATT 


(1) one shot (index 210) downLoaded, 
(2) the BRIC4 taken away and waited until it turns off, then switched on and 


taken two shots 


(3) in the meanwhile on topodroid closed the download and then reopened, before 


the BRIC is back 


(4) when the bric is back the two shots (index 211 and 212) are downloaded 
shot 212 is sent twice, but TopoDroid recognizes that as a repeated trasnfer 


and skips it 


(5) the download is closed, then opened again 

(6) two shots are taken with the BRIC and get downloaded (index 213 and 214) 

(7) the BRIC is taken away again as in step (2) 

(8) in the meanwhile on TopoDroid the download is closed. 

(9) when the BRIC is back, the download iS opened again, and the two shots (index 


215 and 216) gets downloaded 


here is the TopoDroid log (the same can be seen from the btsnoop_hci log 


20210401f): 


04-01 20:08:05.785 19480 31379 V Distox 
04-01 20:08:05.785 19480 31379 V Distox 
04-01 20:08:05.793 19480 31379 V Distox 
04-01 20:08:05.793 19480 31379 V Distox 
04-01 20:08:09.576 19480 19492 V Distox 
the BRIC4 connects and one shot is taken 
04-01 20:08:09.780 19480 19541 V Distox 
04-01 20:08:09.878 19480 19493 V Distox 
04-01 20:08:09.977 19480 19492 V Distox 
04-01 20:08:16.885 19480 19541 V Distox 
04-01 20:08:16.887 19480 19497 V Distox 


04-01 20:08:17.269 19480 19497 V Distox 
04-01 20:08:30.959 19480 19541 V Distox 
failure - status 8 

the connection is lost, while the BRIC4 
the app 

04-01 20:08:31.009 19480 19541 V Distox 


04-01 20:11:01.354 19480 19493 V Distox 
04-01 20:11:01.356 19480 19493 V Distox 
the BRIC4 is back 


04-01 20:11:04.464 19480 19541 V Distox 
04-01 20:11:04.754 19480 19493 V Distox 
04-01 20:11:04.851 19480 19492 V Distox 
04-01 20:11:04.952 19480 19541 V Distox 
04-01 20:11:09.798 19480 19493 V Distox 
04-01 20:11:09.801 19480 19497 V Distox 


is 


BRIC comm ***** disconnect device 
BRIC comm ***** connect device 

BRIC comm ***** connect BRIC device 
BRIC comm ***** connect GATT 

BRIC comm service discovered 


BRIC comm desc written 000058d2-0000-1000-8000-00805f9b34Ffb 
BRIC comm desc written 000058d3 -0000-1000-8000-00805f9b34Ffb 
BRIC comm desc written 000058d1-0000-1000-8000-00805f9b34fb 
BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer PRIM 


497269 BRIC proto: process - PrimToDo true: 210 prev -1 
510958 BLE callback: callback onConnectionStateChange 


out of reach the connection is closed and later re-opened on 
BRIC comm ***** reconnect device 


BRIC comm ***** reconnect device 
BRIC comm ***** connect GATT 


BRIC comm service discovered 
BRIC comm desc written 000058d2-0000-1000-8000 -00805f9b34Ffb 
BRIC comm desc written 000058d3-0000-1000-8000 -00805f9b34Ffb 
BRIC comm desc written 000058d1-0000-1000-8000 -00805f9b34Ffb 
BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer PRIM 


04-01 
04-01 
04-01 
04-01 
04-01 
shots 
04-01 
04-01 
04-01 
1.238 
04-01 
04-01 
04-01 
04-01 
344.8 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
- sta 


the BRIC4 is brought away and the connection is lost, 


20:11: 


10. 


.193 
.193 
. 380 
382 


778 


19480 
19480 
19480 
19480 


19480 


212 is transferred 


20:11:13. 
20:11:13. 
20:11:13. 


5 Azimuth 
20: 
20: 
20: 
20: 

622 


20:11: 
tus 8 


dis lc 
a i es 
11:13. 
al Bs Boo eS 
temp 22.5 
LS. 
gl Br: 
714, 
Ai 
eel 2 
29, 


195 
796 
798 


178. 


198 
994 
995 
997 


997 
188 
190 
191 
191 
242 


19480 
19480 
19480 
36555 
19480 
19480 
19480 
19480 


19480 
19480 
19480 
19480 
19480 
19480 


19497 V Distox 
19497 V Distox 
19493 V Distox 
19497 V Distox 


19497 V Distox 


twice, 


the second 


19493 V Distox 
19497 V Distox 
19497 V Distox 


Clino 76.138115 


19497 V Distox 
19492 V Distox 
19497 V Distox 
19497 V Distox 
samples 62 type 0 


19497 
19541 
19497 
19497 
19497 
19493 


V 


V 
V 
V 
V 
V 


Distox 
Distox 
Distox 
Distox 
Distox 
Distox 


70192 BRIC proto: added Err 

70193 BRIC proto: process - PrimToDo true: 211 prev -1 

BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer PRIM 


70778 BRIC proto: process - PrimToDo true: 
time it is discarded 

BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer PRIM 

73796 BRIC debug MeasPrim: 20 2021-4-1 19:6:43 Distance 


212 prev 211 


73798 BRIC proto: add Prim - repeated primary 

BRIC comm changed chrt 000058d2-0000-1000-8000-00805f9b34fb 
BRIC comm: Queue buffer META 

73996 BRIC debug MeasMeta: 20 Idx 212 dip -59.902515 roll 


73997 BRIC proto: added Meta 212 

BRIC comm changed chrt 000058d3-0000-1000-8000-00805f9b34fb 

BRIC comm: Queue buffer ERR 

74191 BRIC proto: added Err 

74191 BRIC proto: process - PrimToDo false: skip at 212 

89242 BLE callback: callback onConnectionStateChange failure 


in the meanwhile the BT on the app is reset 


(twice); this has the effect to close ts down load. The download is then re-opened 


04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 
04-01 


20:11: 
big Ba 


29. 
29. 
. 169 
. 169 
. 169 
956 
956 
956 
956 
024 


284 
287 


.056 
057 
999 


the BRIC4 is back, 


04-01 
04-01 
04-01 
04-01 
04-01 


20:13: 


20:13: 
20:13: 


20:13: 
20:13: 


24. 


29. 
30. 


30. 
58. 


830 


973 
159 


561 
284 


failure - status 8 


connection Lost again, 


04-01 
04-01 
04-01 
04-01 
and b 
04-01 
04-01 
04-01 


04-01 


20: 


20: 
20: 
20: 
ack 
20: 


20: 
20: 


20: 


again, 
16:04.651 19480 


19480 
19480 
19480 
19480 
19480 
19480 
19480 
19480 
19480 
19480 


19480 
19480 
19480 


19493 
19493 
19480 
19480 
19480 
19480 
19480 
19480 
19480 
19480 


19492 
19492 
19541 


V 
V 
V 
V 
V 
V 
V 
V 
V 
V 


V 
V 
V 


two shots are 
19480 19492 V 


19480 31517 V 
19480 19492 V 


19480 31517 V 
19480 19492 V 


15:59.181 19480 
15:59.181 19480 
16:04.394 19480 


with two 


16:10.266 19480 
16:10.454 19480 


16:10.851 19480 


19492 


31650 
31650 
19493 
shots 
19541 


31517 
19541 


31517 


V 
V 
V 
V 
V 


V 
V 


V 


Distox BRIC comm ***** reconnect device 

Distox BRIC comm ***** connect GATT 

Distox BRIC comm ***** disconnect device 

Distox BRIC comm ***** close device 

Distox BRIC comm ***** disconnect GATT 

Distox bt button over advanced BRIC 

Distox bt button not over advanced 

Distox BRIC comm ***** disconnect device 

Distox BRIC comm cstr - address D5:2F:DE:2E:98:DE 

Distox bt button over advanced BRIC 

Distox BRIC comm ***** reconnect device 

Distox BRIC comm ***** connect GATT 

DistoX : BRIC comm service discovered 

transferred 

Distox BRIC comm desc written 000058d2-0000-1000 -8000 -00805f9b34Ffb 
Distox 209972 BRIC proto: process - PrimToDo true: 213 prev -1 
Distox BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
Distox 210561 BRIC proto: process - PrimToDo true: 214 prev 213 
Distox 238284 BLE callback: callback onConnectionStateChange 


in the meanwhile 
13:58.316 19480 


Distox 
Distox 
Distox 
Distox 
Distox 


Distox 
Distox 


Distox 


me down Load 


is closed and then re-opened 


BRIC comm ***** reconnect device 


***** Connect BRIC device 
connect GATT 
service discovered 


BRIC 
BRIC 
BRIC 


comm 
comm 
comm 


KKKKK 


BRIC comm desc written 000058d2-0000-1000-8000-00805f9b34Ffb 


370266 BRIC proto: process - PrimToDo true: 215 prev -1 
BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
370851 BRIC proto: 


process - PrimToDo true: 216 prev 215 


Two more tests did not show any problem. 


Open download and get one shot (index 217) 

take the BRIC away, out or reach and take two shots 
in the meanwhile closet+topen the downLoad 

take the BRIC back: 
take the BRIC away and take two more shots 
in the meanwhile close the download 

take the BRIC back 


open the download: 


the shots are transferred (index 218 219) 


two shots transgerred (index 220 221). 


(9) close the download 
(10) take two shots, with TopoDroid in reach 
(11) open the download: two shots transferred (index 222, 223) 


) Open download and get one shot (index 217) 

) take the BRIC away, out or reach 

) turn off downaload on TopoDroid 

4) when the BRIC goes off turn it on and take two shots 
5) bring BRIC back 

6) turn on download: the two shots are transferred (index 225 226) 
7) when the BRIC gos off take it away, take two shots 
8) turn download off 

9) take bric close - no download, no bt icon on bric 
10) take if away, stil in reach, one more shot 

11) turn download on: three shots transferred 

12) bric goes off - topodroid shows connected 

13) take bric away, far, turn on, take two shots 

14) topodroid shows non connected 

15) bring bric back: shots transferred 


(1 
(2 
(3 
( 
( 
( 
( 
( 
( 
( 
( 
( 
( 
( 
( 


[5] THE FLAW IN THE OINTMENT 


‘INS +31N8 @ 


However this communication model is not 
completely flawless. The BRIC does not 
communicate with the app, but with 
Android. The Android open the 
communication with the BRIC only when 
there 1S an app ready to handle the 
data. At that point the BRIC is 
connected with Android, and (after a 
few seconds) it transmits data whenever : 
there are data, until it has 
transmitted all, or Android closes the | 
communication. | 290 2,17 

If the app closes the channel with 270.0 4 20 m7 
Android while the BRIC is in the middle | 
of a data transfer, and Android does 
not close the communication with the 
bRIC at the same time, the BRIC 
continues to send data, which are 
acknowledged by Android and Lost. 





Here 1S a test which shows the problem. After the first connection and data 
transfer, the BRIC4 is turned off and brought away. There it is turned on, shots 
are taken, and turned off again. It is then taken back to Android, and turned on. 
Soon after TopoDroid shows that the BRIC4 has connected, the user closes the data 
download. At this point TopoDroid closes the channel with Android. The BRIC4 
continues to send data, but they are Lost. (The TopoDroid logs have been 
considerably shortened). 


04-03 08:22:01.820 12141 22633 V DistoxX : 121819 BRIC proto: added Prim 2.1665000915527344 
263.6/7645263671875 76.10911560058594 

04-03 08:22:02.184 12141 22633 V DistoX : 122184 BRIC proto: process - PrimToDo true: 269 prev -1 
04-03 08:22:11.153 12141 22633 V DistoX : 131152 BRIC proto: process - PrimToDo true: 270 prev 269 
04-03 08:22:14.565 12141 22633 V DistoX : 134565 BRIC proto: process - PrimToDo true: 271 prev 270 


04-03 08:22:18.174 12141 22633 V DistoxX : 138174 BRIC proto: process - PrimToDo true: 272 prev 271 


04-03 08:22:28.547 12141 12154 V Distox : 148546 BLE callback: callback onConnectionStateChange 
failure - status 8 

04-03 08:22:58.707 12141 12153 V DistoxX : 178706 BLE callback: callback onConnectionStateChange 
failure - status 133 

04-03 08:23:55.192 12141 22633 V DistoX : 235192 BRIC proto: added Prim 1.1785000562667847 

178 .50384521484375 83.8818588256836 


04-03 08:23:55,579 12141 22633 V DistoxX : 235578 BRIC proto: process - PrimToDo true: 273 prev -1 


04-03 08:23:56.160 12141 22633 V DistoxX : 236160 BRIC proto: process - PrimToDo true: 274 prev 273 
a user induced disconnect+connect occurred here 

04-03 08:23:56.351 12141 22633 V DistoX : 236351 BRIC proto: added Prim 4.0945000648498535 
8.851112365722656 3.829310894012451 

04-03 08:24:20.602 12141 22633 V DistoX : 260601 BRIC proto: added Prim 1.0954999923706055 

269 .31103515625 -5.290781497955322 

04-03 08:24:20.754 12141 22633 V DistoX : 260754 BRIC proto: added Meta 279 

04-03 08:24:20.949 12141 22633 V DistoX : 260949 BRIC proto: added Err 

04-03 08:24:20.949 12141 22633 V DistoX : 260949 BRIC proto: process - PrimToDo true: 279 prev -1 


[] btsneep_hei-test13.log aie 


File Edit View Go Capture Analyze Statistics Telephony Wireless Tools Help 
24g 4O BH RG °C eDe*? UE 2AQQAe 


| | bluetooth.addr == d5:2f:de:2e:98:de ES +| Expression... + 





z 


No. Time Source Destination Protoco Len Info 
1004 146.1684... d5:2f:de:2e:98:de . SamsungE_6/7:62:d7 .. L2CAP 21 Revd Connection Parameter Update Request 
1005 146.1713... SamsungE_67:62:d7 . d5:2fi:de:2e:98:de .. L2CAP 15 Sent Connection Parameter Update Response (Accepted) 
1010 146.8862... d5:2fideize:98ide . SamsungE_6/:62:d7? .. ATT 32 Revd Handle Value Indication, Handle: Ox@@24 (Unknown) 
1011 146.8908... SamsungE_ 6/7:62:d/ . db:2fide:ze:98ide .. ATT 16 Sent Handle Value Confirmation, Handle: @x0024 (Unknown) 
1012 147.0794... d5:2f:de:2e:98:de . SamsungE_6/:62:d7 .. ATT 32 Revd Handle Value Indication, Handle: Ox@@28 (Unknown) 
1013 147.0809.. SamsungE_6/:62:d/ . db:2fide:2e:98:de . ATT 16 Sent Handle Value Confirmation, Handle: O@x@028 (Unknown) 
1015 147.2743... d5:2f:de:2e:98:de . SamsungE_67:62:d7 .. ATT 32 Revd Handle Value Indication, Handle: Ox@@2c (Unknown) 
1016 147.2758... SamsungE_6/7:62:d/ . d5:2fide:ze:98ide . ATT 16 Sent Handle Value Confirmation, Handle: Ox0@02c (Unknown) 
1018 147.4674... d5:2fideize:98:de . SamsungE_6/:62:d7? .. ATT 32 Revd Handle Value Indication, Handle: Ox@@24 (Unknown) 
1019 147.4695... SamsungE_6/7:62:d/ . d5:2fide:2ze:98:de . ATT 16 Sent Handle Value Confirmation, Handle: @x@024 (Unknown) 
1020 147.6629... d5:2f:de:2e:98:de . SamsungE_6/:62:d7 .. ATT 32 Revd Handle Value Indication, Handle: Ox@@28 (Unknown) 
1621 147.6692.. SamsungE_67:°62:d7 .. d5:2fide:2e:98ide .. ATT 16 Sent Handle Value Confirmation, Handle: @x0028 (Unknown) 
1023 147.8582... d5i2fidei2ze:98:de . SamsungE_6/:62:d7? .. ATT 32 Revd Handle Value Indication, Handle: Ox@@2c (Unknown) 
1024 147.8607... SamsungE 6/7:62:d/ . db:2fide:ze:98ide . ATT 16 Sent Handle Value Confirmation, Handle: Ox@02c (Unknown) 
1026 148.0523... d5:2f:de:2e:98:de . SamsungE_6/:62:d7 .. ATT 32 Revd Handle Value Indication, Handle: Ox@@24 (Unknown) 

SamsungE_ 6/7:62: . G5:4fide:4e:98:de . ATT Sent Handle Value Confirmation, Handle: @x0024 (Unknown) 

: . O5:2f:de:2e:98:de . SamsungE 67:62: 5 Z Handle Indication, Handle: @x@@26 (Unknown) 

1029 148.2476... SamsungE_6/:62:id/ . d5:2fide:2e:98: w ATT sent Handle Value Confirmation, Handle: Ox0@028 (Unknown) 

1031 148.4459... d5:2f:de:2e:98:de . SamsungE_6/:62:d? .. ATT 32 Revd Handle Value Indication, Handle: Ox@@2c (Unknown) 

1032 148.4461... SamsungE_6/7:62:d/ . d5:2fide:2ze:98:de . ATT 16 Sent Handle Value Confirmation, Handle: Ox@02c (Unknown) 

1034 148.6410.. d5:2f:de:2e:98:de . SamsungE_6/:62:d7 .. ATT 32 Revd Handle Value Indication, Handle: Ox@@24 (Unknown) 

1035 148.6413.. SamsungE_6/7:62:d/ . d5:2fide:ze:98ide . ATT 16 Sent Handle Value Confirmation, Handle: Ox0024 (Unknown) 

1037 148.8328... d5i2fide:ze:98ide . SamsungE_6/:62:d? .. ATT 32 Revd Handle Value Indication, Handle: Ox@@28 (Unknown) -— J 

1038 148.8341.. SamsungE 6/7:62:d/ . db5:2fide:2ze:98:de . ATT 16 Sent Handle Value Confirmation, Handle: @x0028 (Unknown) 

1039 149.0295... d5:2f:de:2e:98:de . SamsungE_6/:62:d? .. ATT 32 Revd Handle Value Indication, Handle: Ox@@2c (Unknown) 

1040 149.0309.. SamsungE_6/:62:d/ . db:2fide:2e:98:de . ATT 16 Sent Handle Value Confirmation, Handle: Ox@02c (Unknown) 

1042 149.2245.. d5i2fide:ze:98ide . SamsungE_6/:62:d? .. ATT 32 Revd Handle Value Indication, Handle: Ox@@24 (Unknown) 

1043 149.2257... SamsungE 6/:62:d/ . d5:2fide:ze:98ide .. ATT 16 Sent Handle Value Confirmation, Handle: Ox0024 (Unknown) 

1644 149.4195... d5:2fide:ze:98:de . SamsungE_ 6/:62:d? . ATT 32 Revd Handle Value Indication, Handle: Ox@@28 (Unknown) 

1045 149.4208... SamsungE_6/:62:d/ . d5:2fide:ze:98:de . ATT 16 Sent Handle Value Confirmation, Handle: @x@028 (Unknown) 

1647 149.6147... d5:2f:de:2e:98:de . SamsungE_6/:62:d/ .. ATT 32 Revd Handle Value Indication, Handle: Ox@@2c (Unknown) 

1048 149.6156.. SamsungE_6/7°62:d/ . d5:2fide:ze:98ide . ATT 16 Sent Handle Value Confirmation, Handle: OxO@0Q2c (Unknown) 

1050 149.8096.. d5:2fideize:98:de . SamsungE_6/:62:d7? .. ATT 32 Revd Handle Value Indication, Handle: Ox@024 (Unknown) 

1051 149.8110... SamsungE_ 6/7:62:d/ . d5:2fide:2ze:98ide . ATT 16 Sent Handle Value Confirmation, Handle: Ox0024 (Unknown) 

1052 150.0039... d5:2f:de:2e:98:de . SamsungE_6/:62:d? .. ATT 32 Revd Handle Value Indication, Handle: Ox@@28 (Unknown) 

1053 150.0045.. SamsungE_6/7:62:d/ . db:2f:de:2e:98:de . ATT 16 Sent Handle Value Confirmation, Handle: ®x@028 (Unknown) 

1655 158.7995. dis?ftide:?e: 9A: de. SamsiunnF Af: 62:7 ATT. 3? Revd Handle Value Tndication. Handle: @xe@eec fUnknown' be 






» Frame 1028: 32 bytes on wire (256 bits), 32 bytes captured (256 bits) = 
* Bluetooth 

* Bluetooth HCI H4 

» Bluetooth HCI ACL Packet 

+ Bluetooth L2CAP Protocol ¥ 
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The wireshark screenshot shows that the BRIC4 continues to transfer data after the 
app has closed its channel. The highlighted Line is the META with index 275 (bytes 
13 01 00 00 ...). 


[6] ANOTHER FLAW TEST 
In this test the BRIC4 was taken away. At some point Android signalled that the 


connection had been lost (the download arror turned orange) and I switched the 
download off (blue arror). When I got to the BRIC4 I found it had turned off. I 


turned it on and took a couple of shots. Then I brought it back to Android, and 
Started the download (red arrow). The two shot did not appear in TopoDroid. 


Ql: > 


SAMSUNG 





Topodroid log: 


04-01 11:47:57.982 19480 23589 V DistoxX : BRIC comm ***** disconnect device 
04-01 11:47:57.982 19480 23589 V DistoxX : BRIC comm ***** connect device 
04-01 11:47:57.987 19480 23589 V DistoxX : BRIC comm ***** connect BRIC device 
04-01 11:47:57.987 19480 23589 V DistoxX : BRIC comm ***** connect GATT 

04-01 11:48:07.138 19480 19493 V DistoxX : BRIC comm service discovered 


connection and subscriptions 
04-01 11:48:07.291 19480 19492 
04-01 11:48:07.388 19480 19541 
04-01 11:48:07.487 19480 19493 
04-01 11:48:11.297 19480 19492 
TArset Snot 


DistoxX : BRIC comm desc written 000058d2-0000-1000-8000-00805f9b34Ffb 
DistoX : BRIC comm desc written 000058d3-0000-1000-8000-00805f9b34Ffb 
DistoX : BRIC comm desc written 000058d1-0000-1000-8000-00805f9b34fb 
DistoX : BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 


04-01 11:48:11.485 19480 19497 V Distox : 491485 BRIC proto: process - PrimToDo true: 201 prev -1 
04-01 11:48:32.398 19480 19480 V DistoX : BRIC comm ***** disconnect device 

04-01 11:48:32.399 19480 19480 V DistoX : BRIC comm ***** close device 

user closes the download and re-open it - in the meanwhile shots are taken 


04-01 11:49:11.549 19480 23725 V DistoxX : BRIC comm ***** connect BRIC device 
04-01 11:49:11.549 19480 23725 V DistoxX : BRIC comm ***** connect GATT 

04-01 11:49:11.972 19480 19493 V DistoxX : BRIC comm service discovered 
connection and download of the shots 


04-01 11:49:12.477 19480 19493 V DistoX : BRIC comm desc written 000058d1-0000-1000-8000-00805f9b34fb 
04-01 11:49:17.571 19480 19492 V DistoX : BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 


04-01 11:49:17.960 19480 19497 V DistoxX : 557960 BRIC proto: process - PrimToDo true: 202 prev -1 
04-01 11:49:18.152 19480 19492 V DistoX : BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 


04-01 11:49:18.546 19480 19497 V DistoxX : 558546 BRIC proto: process - PrimToDo true: 203 prev 202 
04-01 11:51:01.577 19480 19492 V Distox : 61577 BLE callback: callback onConnectionStateChange failure 
- status 8 

connection lost 

04-01 11:51:01.600 19480 19492 V DistoX : BRIC comm ***** reconnect device 


04-01 11:52:30.263 19480 23868 V DistoxX : BRIC comm ***** connect GATT 

04-01 11:52:30.284 19480 19493 V DistoxX : BRIC comm service discovered 

connection re-established - two data alates been lost 

04-01 11:52:31.168 19480 19492 V DistoxX : BRIC comm desc written 000058d2-0000-1000-8000-00805f9b34Ffb 
04-01 11:52:31.364 19480 19541 V DistoxX : BRIC comm desc written 000058d3-0000-1000-8000-00805f9b34Ffb 
04-01 11:52:31.559 19480 19493 V DistoxX : BRIC comm desc written 000058d1-0000-1000-8000-00805f9b34Ffb 
04-01 11:52:45.050 19480 19492 V DistoX : BRIC comm changed chrt 000058d1-0000-1000-8000-00805f9b34fb 
04-01 11:52:45.054 19480 19497 V DistoX : BRIC comm: Queue buffer PRIM 


04-01 11:52:45,055 19480 19497 V DistoxX : 165055 BRIC debug MeasPrim: 20 2021-4-1 10:49:13 Distance 
1.3685 Azimuth 353.1867 Clino 0.8300475 

04-01 11:52:45.057 19480 19497 V DistoxX : 165057 BRIC proto: added Prim 1.368499994277954 
353.18670654296875 0.8300474882125854 

04-01 11:52:45.207 19480 19541 V DistoX : BRIC comm changed chrt 000058d2-0000-1000-8000-00805f9b34fb 
04-01 11:52:45.208 19480 19497 V DistoxX : BRIC comm: Queue buffer META 

04-01 11:52:45,210 19480 19497 V DistoxX : 165209 BRIC debug MeasMeta: 20 Idx 206 dip -60.509758 roll 
359.7464 temp 26.0 samples 79 type 0 

04-01 11:52:45,210 19480 19497 V DistoX : 165210 BRIC proto: added Meta 206 

04-01 11:52:45.407 19480 19493 V DistoX : BRIC comm changed chrt 000058d3-0000-1000-8000-00805f9b34fb 
04-01 11:52:45.410 19480 19497 V DistoX : BRIC comm: Queue buffer ERR 

04-01 11:52:45.410 19480 19497 V DistoxX : 165410 BRIC proto: added Err 

04-01 11:52:45.411 19480 19497 V DistoxX : 165411 BRIC proto: process - PrimToDo true: 206 prev -1 


The last data before reconnecting has index 203. The first data after reconnecting 
has index 206. Two data have been Lost in the between. To get a better insight into 
the problem I inspect the btsnoop_hci.log with wireshark. 


I look for the META indications. At byte 12 (that is where the BRIC4 index value 
is) there are: 

at 949 102.008525: ca 00 00 00 ... that is 202 

at 957 102.593999: cb 00 00 OO ... 

at 1039 258.946884: cc 00 00 00 ... that is 204 


That 1S upon returning the connection with Android the BRIC4 transmits the data 
even if there is no app ready to handle them. 

















|]. btsnoop_hci-20210401d.log [ies fel pled 
File Edit View Go Capture Analyze Statistics Telephony Wireless Tools Help 
eet —— a. wa. 
4A ORF BH LC eDBZ*Ueesaaraaks 
| | bluetooth.addr == d5:2f:de:2e:98:de x) ~| Expression... + 
No. Time Source Destination Protocol Lengtt Info = 
953 102.210781 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x002c (Unknown) 
954 102.398387 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: 0x0024 (Unknown) 
955 102.400859 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 90x0024 (Unknown) 
957 102.593909 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: 0x0028 (Unknown) 
958 102.597441 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x0028 (Unknown) 
959 102.788673 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: 0x002c (Unknown) 
960 102.789679 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x002c (Unknown) 
982 225.949063 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... L2CAP 21 Rcvd Connection Parameter Update Request 
983 225.952561 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () L2CAP 15 Sent Connection Parameter Update Response (Accepted) 
1037 258.754457 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: 0x0024 (Unknown) 
1038 258.756780 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 90x0024 (Unknown) 
. 946884 d5:2f:de:2e:98: SamsungE 67: S Value Indication, Handle: 0x0028 (Unknown 
— 1040 258.947492 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 0x0028 (Unknown) 
1042 259.144066 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: Ox002c (Unknown) 
1043 259.145368 SamsungE_67:62:d7 (Sa... d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x002c (Unknown) 
1045 264.212934 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: 0x0024 (Unknown) ~~) 
1046 264.217289 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 90x0024 (Unknown) 
1047 264.506500 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun.. ATT 32 Revd Handle Value Indication, Handle: 0x0028 (Unknown) 
1048 264.506818 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: 9x0028 (Unknown) 
1050 264.701428 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 32 Revd Handle Value Indication, Handle: Ox002c (Unknown) 
1051 264.702797 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 10 Sent Handle Value Confirmation, Handle: Ox002c (Unknown) 
1055 294.535222 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 14 Sent Write Request, Handle: 0x0029 (Unknown) 
1057 295.412595 d5:2f:de:2e:98:de () SamsungE_67:62:d7 (Samsun... ATT 10 Revd Write Response, Handle: 0x0029 (Unknown) 
1058 295.430303 SamsungE_67:62:d7 (Sa. d5:2f:de:2e:98:de () ATT 14 Sent Write Request, Handle: 0x002d (Unknown) 
; 1060 295.607939 d5:2f:de:2e:98:de () SamsungE 67:62:d7 (Samsun... ATT 10 Revd Write Response. Handle: Ox002d (Unknown) : be 
» Frame 1039: 32 bytes on wire (256 bits), 32 bytes captured (256 bits) a 
>» Bluetooth 
>» Bluetooth HCI H4 
>» Bluetooth HCI ACL Packet 
>» Bluetooth L2CAP Protocol v 
02 40 20 ib 00 17 00 04 O00 id 28 00 cc 00 00 00 a ( 
5b dc 9a c2 dd a2 b2 43 00 00 dO 41 3F 00 00 2c_ ~=C[ C A?:-, 
@ 7 _ btsnoop hci-20210401d.log Packets: 1071 : Displayed: 60 (5.6%) Profile: Default 





[7] Trying to counteract the protocol flaw 


When the app closes the connection Android closes the channel with the BRIC4 (the 
bluetooth icon disappear from the BRIC4 screen). There is a smaLl time frame 
between Android taking the app command to close the connection, and closing the 


Channel with the BRIC4 To reduce the chance of a missed data, if a PRIM data has 
arrived, the app delays a "close" until the ERR data has been processed. This is 
however not sufficent to guarantee that no data is lost. 


[8] Conclusions 


The BRIC4 BLE protocol has a flaw: it relies on the acknowLedgment from Android, 
and does not require acknowLegdement from the application. The situation was 
depicted in the image in section [5]. In this model Android is an intermediary 
between the BRIC4 and the application and the two do not communicate directly. 


For a robust communication Android must be a channel between the BRIC4 and the 
application, and the state of the communication must be determined by the two 
endpoints. 





